CVE-2026-65603

HighCVSS 8.8/10Last modified Oct 24, 2026

Description

The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler (processUserProfile(), the update_user task). Unlike the registration handler, this handler does not strip privilege fields ('groups','access') from user-submitted form data before persisting them. When an administrator has added 'groups' and/or 'access' to plugins.login.user_registration.fields and the default 'regular'/DataUser account backend is in use, a low-privilege authenticated user can POST crafted profile form data (e.g. access[admin][super]=true) to escalate to super-admin, enabling admin panel access, scheduler abuse (RCE), and Twig evaluation. Fixed in 3.8.12.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
getgrav	grav	< 3.8.12

References

Timeline

Published: Jul 22, 2026
Last modified: Oct 24, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-656048.2Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego CVE-2026-656059.6SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (database) cell rendering. A Template column val CVE-2026-656069.6SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/<name> link re CVE-2026-656076.5SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/se CVE-2026-656088.8Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField() resolves blueprint CVE-2026-656092.4nnn is vulnerable to Out-of-Bound write vulnerability. Due to lack of validation of attacker-controlled length fields deserialized from a se CVE-2026-65614.7A vulnerability was detected in EyouCMS up to 1.7.1. This issue affects the function edit_adminlogo of the file application/admin/controller CVE-2026-656102.4nnn stores homelen variable as uchar_t, which can only represent values in the range 0-255. An attacker who can influence the victim's execu CVE-2026-656115.1nnn does not sanitize the path variable. An attacker can create a directory on a shared filesystem, removable media, or inside an extracted CVE-2026-656125.1nnn does not sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or in CVE-2026-656134.3Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting de CVE-2026-656168.8Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token.